On 17 July 2018, the EU and Japan successfully concluded their talks on reciprocal adequacy. They agreed to recognise each other's data protection systems as 'equivalent', which will allow data to flow safely between the EU and Japan creating the world's largest area of safe data flows.

Launch of Internal Procedures

Each side will now launch its relevant internal procedures for the adoption of its adequacy finding. For the EU, this involves obtaining an opinion from the European Data Protection Board (EDPB) and the green light from a committee composed of representatives of the EU Member States. Once this procedure will have been completed, the Commission will adopt the adequacy decision on Japan.

Impact

This mutual adequacy arrangement will create the world's largest area of safe transfers of data based on a high level of protection for personal data. Europeans will benefit from strong protection of their personal data in line with EU privacy standards when their data is transferred to Japan.

With this agreement, the EU and Japan affirm that, in the digital era, promoting high privacy standards and facilitating international trade go hand in hand. Under the GDPR, an adequacy decision is the most straightforward way to ensure secure and stable data flows.

Key Elements of Adequacy Decisions

The agreement found today foresees a mutual recognition of an equivalent level of data protection by the EU and Japan. Once adopted, this will cover personal data exchanged for commercial purposes, ensuring that in all exchanges a high level of data protection is applied.*

To live up to European standards, Japan has committed to implementing the following additional safeguards to protect EU citizens' personal data, before the Commission formally adopts its adequacy decision:

Additional Safeguards:
A set of rules providing individuals in the EU whose personal data are transferred to Japan, with additional safeguards that will bridge several differences between the two data protection systems. These additional safeguards will strengthen, for example, the protection of sensitive data, the conditions under which EU data can be further transferred from Japan to another third country, the exercise of individual rights to access and rectification. These rules will be binding on Japanese companies importing data from the EU and enforceable by the Japanese independent data protection authority (PPC) and courts.

Complaint Handling Mechanism:
A complaint-handling mechanism to investigate and resolve complaints from Europeans regarding access to their data by Japanese public authorities. This new mechanism will be administered and supervised by the Japanese independent data protection authority.

Next Steps

The Commission is planning on adopting the adequacy decision in autumn this year, following the usual procedure:

Approval of the draft adequacy decision by the College

Opinion from the European Data Protection Board (EDPB), followed by a comitology procedure

Update of the European Parliament Committee on Civil Liberties, Justice and Home Affairs